In accordance with the General Data protection Regulation(GDPR), patients (data Subjects) have the right to access their data and any supplementary information held by Dr Malik Practice: this is commonly known as a data subject access request (DSAR). Dat subject have a right to receive:
- Confirmation that there data is being processed
- Access to their personal data
- Access to any other supplementary information held about them
Ways to access
Best practice recommendation in the GDPR is that, organisations should be able to provide remote access to a secure self-service system which would provide the individual with the direct access to his or her information. Please contact us to applyfor online services if you have not already done so. signing up to the practice secure online service will provide patients with the data held in their medical records such as demographic, allergies and sensitivities, results, problems and diagnosis, procedures, ethnicity, medication, vaccinations.
In order to access on line services, Please download online access form and guidance from here
You will need to return the completed paper copy of online form to the practice with identification before being granted access to your records.
Patients may request paper copies of their health records , request can be made by email to firstname.lastname@example.org. However patients may request access to their health records informally.
Data Subject Access Request Application form
Regardless of the preferred method of access, patients and authorised thirt parties must initially complete DSAR Form. In order for us to process and verify all requests from Data subjects, you must submit a Data Subject Access Request form. The DSAR form is available from the practice website.in downloadable section or click here Application_form_for_access_to_health_records.docx
Alternatively, a paper copy of DSAR is available from reception. You will need to return the completed paper copy of DSAR form to the practice with Proof of Identity. We accept the following forms of identification: one of them should be photographic identification and one copy of Utility bill
- UK Driving Licence
- Current UK Passport
- Birth Certificate
- Utility Bill for supply of gas, electric,water or telephone.
Time Frame to respond to your DSAR
In accordance with the GDPR, patients are entitled to receive a response within the maximum given time of one calendar month from the date of submission of the DSAR.
Complex or multiple Requests
In the case of Complex or multiple requests, Dr Malik Practice will require more time to honor the request from Data Subject. In such situation we may extend the response time by a period of two months. The data subject will be in informed and reasons for the extension given in a timely manner with in one month.
Declining a Request
Where Dr Malik Practice decide to decline requests and not take any action on the request of data subject due to excessive, manifestly unfounded or repetitive requests. you will be informed of this decision without any delay and at the latest within one month of receipt of the request.
There may be occasions when data controller will withhold information kept in the health record,particularly if the disclosure of such information is likely to cause undue stress or harm to you or any other person. Or when the record has the information relating to third party.
Free of Charge with Exceptions
Under the GDPR we are to provide copies of health records free of charge but with some exceptions.
If you don not have access to practice online services, we will provide a copy of the information free of charge,as per GDPR rules. However we may charge a 'reasonable fee' when a request is manifestly unfounded or excessive, particularly if it is repetitive.
We may also charge a reasonable fee to comply with requests for further copies of the same information. We understand that this does not mean that we can charge for all subsequent access requests.
Data Subjects and Third Party Requesting access to records
Requests may or may not be received from the following:
Competent patients .may apply for access to their own records or authorise third-party access to their records.
Children and Young People may also apply in the same manner as other competent patients and Dr Malik Practice will not automatically presume a child or young person has capacity under the age of 16. However, those aged 12 or over are expected to have the capacity to consent to medical information being disclosed.
Parents may apply to access their child's health record so long as it is not in contradictionto the wishes of the competent child. https://www.bma.org.uk/advice/employment/ethiccs/children-and-young-people/parental-responsibility
Individuals with a responsibility for adults who lack capacity are not automatically entitled to access the individual's health records. Dr.Malik Practice that the patient's capacity is judged in relation to a particular decisions being made. any considerations to nominate an authorised individual to make proxy decisions for an individual who lacks Capacity will comply with the Mental Capacity act in England and wales and the Adults with Incapacity Act Scotland.
Next Of Kin (NOK) have no rights of access to health records.
Police are not able to access health records without first obtaining a court order or warrant. However , health professionals at Dr Malik Practice may disclose relevant information to the police if the patient has consented or if there is overriding public interest.
Solicitors and insurance companies in most cases will provide the patient's signed consent to release information held in their record. Dr Malik practice will ensure that patients are fully aware of the information being provided to the solicitor who is acting for that patient. In the case of a solicitor requesting information, the BMA has provided the following template:
Dr Malik practice will ask solicitors to use the appropriate form when requesting information.
Deceased patients retain the right of confidentiality. There are number of considerations taken into account prior to disclosing the health record of a deceased patient. Such considerations are detailed in the Access to Health Records Act 1990. Under the terms of this Act, Dr Malik Practice will only grant access if you are either:
- a personal representative( executor of the deceased person's estate)
- someone who has a claim resulting from the death
The medical records of the deceased will be passed to Primary Care Support Team(PCSE) for storage . Dr Malik Practice can advise you who you need to contact in such instances. PCSE will retain the GP records of deceased patients for ten years, after which time they will be destroyed. PCSE have provided an application form.doc which can be used to request copies of a deceased patient's record.
In the case of any third -party requests, Dr Malik practice will ensure that the patient has consented to the disclosure of this information by means of a valid signature of the patient.
Dr Malik Practice is the data controller. Should you have any questions relating to accessing your medical records, please ask to discuss this with The Practice Manager
Review: June 2019